General
-
Target
2024-03-31_541795bc71cff09d3743baf59c2baf14_icedid
-
Size
2.4MB
-
Sample
240331-p2wd6acc57
-
MD5
541795bc71cff09d3743baf59c2baf14
-
SHA1
9179b9549e929fa21d74787e135cd1ea07a56f4a
-
SHA256
9e8421d515cd41c76b1ad1780cab6a7d12fc1f54a17ba76cb89f02dcb7dca592
-
SHA512
f8966a98671c18c3f6e45dd6ef93b8a5bc457ca4d95c09f1489470dd0c4c18f55d8614cbd988e98fa3c0c33ff5c7b84e915bd840830f4f1d1114277c5faaac50
-
SSDEEP
49152:1k2Ze+DvSp24SiwRWBFMTxF/W/IhJHdt2ay1aaKo+rGzCpEmZ3On83/I/pIgqyIv:6wRWBFYdt2anaKo+rGzCpEmZ3On83w/K
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-31_541795bc71cff09d3743baf59c2baf14_icedid.exe
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
2024-03-31_541795bc71cff09d3743baf59c2baf14_icedid
-
Size
2.4MB
-
MD5
541795bc71cff09d3743baf59c2baf14
-
SHA1
9179b9549e929fa21d74787e135cd1ea07a56f4a
-
SHA256
9e8421d515cd41c76b1ad1780cab6a7d12fc1f54a17ba76cb89f02dcb7dca592
-
SHA512
f8966a98671c18c3f6e45dd6ef93b8a5bc457ca4d95c09f1489470dd0c4c18f55d8614cbd988e98fa3c0c33ff5c7b84e915bd840830f4f1d1114277c5faaac50
-
SSDEEP
49152:1k2Ze+DvSp24SiwRWBFMTxF/W/IhJHdt2ay1aaKo+rGzCpEmZ3On83/I/pIgqyIv:6wRWBFYdt2anaKo+rGzCpEmZ3On83w/K
-
Modifies firewall policy service
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
-
UPX dump on OEP (original entry point)
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1